The disclosure relates to a method and a device for controlling a drive train. A method and a device for controlling a drive train are known from DE 198 51 457. In said document, a method and a device for controlling the torque of a drive unit are proposed. A setpoint value for a torque of the drive unit is formed at least on the basis of the position of an operator control element which can be activated by the driver. In addition, an actual value for the torque is acquired and at least one control variable for the torque of the drive unit is formed as a function of the setpoint value. A signal is generated as a function of the deviation between the setpoint value and the actual value, by means of which signal the control variable is reduced if the actual value exceeds the setpoint value.
Guide ECE R100 for battery-operated electric vehicles requires that a fault (for example in the engine control device) in a standing unbraked vehicle must not lead to a movement >10 cm. (Cf. Section 5.2.2.3: unintentional acceleration, deceleration and reversal of the drive train shall be prevented. In particular, a failure (for example in the drive power system) shall not cause more than 0.1 m movement of a standing unbraked vehicle).
Electric motors are monitored for undesired torque. As soon as a fault is detected, the electric motor goes into its safe state in which it can no longer provide a positive torque. In order to prevent an undesired movement, very short fault reaction times are necessary. These are very difficult to implement and lead to a reduction in the availability. Known concepts operate with fault times of 500 ms. However, electric motors already provide their maximum torque at low rotational speeds, with the result that a corresponding fault can lead to a movement of several meters depending on the vehicle. A reduction in the fault times is possible, but runs up against technical limits under certain circumstances. A known concept is based on monitoring the functional computer by means of a monitoring module in which an enquiry/response communication is carried out between these components. The time between an enquiry and a response cannot be reduced further owing to the sequencing of the software modules in the functional computer (often >10 ms). Even if the times are reduced, this can have negative consequences for the availability of the system since faults are debounced for a shorter time and lead more quickly to switching off. Even with short fault reaction times, an unbraked vehicle will probably roll for more than 10 cm after a “torque shock” on a precipitous road.